From 04e586c23e5a316a5a951b6449d500f482c658b8 Mon Sep 17 00:00:00 2001
From: twentyOne2x <contact@attn.market>
Date: Tue, 7 Jul 2026 12:47:29 +0200
Subject: [PATCH] Retain GCP readiness workflow artifacts

---
 .github/workflows/gcp-readiness.yml  | 25 ++++++++++++++-----------
 ops/check_gcp_infra_readiness.py     |  3 ++-
 tests/test_gcp_readiness_workflow.py | 10 ++++++++++
 3 files changed, 26 insertions(+), 12 deletions(-)
 create mode 100644 tests/test_gcp_readiness_workflow.py

diff --git a/.github/workflows/gcp-readiness.yml b/.github/workflows/gcp-readiness.yml
index a1a5f18..fbbc5ba 100644
--- a/.github/workflows/gcp-readiness.yml
+++ b/.github/workflows/gcp-readiness.yml
@@ -15,6 +15,7 @@ env:
   PROJECT_ID: teleo-501523
   WORKLOAD_IDENTITY_PROVIDER: projects/785938879453/locations/global/workloadIdentityPools/github-actions/providers/living-ip-github
   ARTIFACT_SERVICE_ACCOUNT: sa-artifact-builder@teleo-501523.iam.gserviceaccount.com
+  READINESS_ARTIFACT_DIR: gcp-readiness-artifacts
 
 jobs:
   readiness:
@@ -36,31 +37,33 @@ jobs:
         shell: bash
         run: |
           set +e
-          mkdir -p .gcp-readiness
+          mkdir -p "${READINESS_ARTIFACT_DIR}"
           {
             echo "project=${PROJECT_ID}"
             echo "service_account=${ARTIFACT_SERVICE_ACCOUNT}"
             echo "workflow_ref=${GITHUB_REF}"
             echo "revision=${GITHUB_SHA}"
-          } > .gcp-readiness/context.txt
-          gcloud auth list --format=json > .gcp-readiness/gcloud-auth-list.json 2> .gcp-readiness/gcloud-auth-list.stderr
-          echo "$?" > .gcp-readiness/gcloud-auth-list.exitcode
-          gcloud config list --format=json > .gcp-readiness/gcloud-config-list.json 2> .gcp-readiness/gcloud-config-list.stderr
-          echo "$?" > .gcp-readiness/gcloud-config-list.exitcode
+          } > "${READINESS_ARTIFACT_DIR}/context.txt"
+          gcloud auth list --format=json > "${READINESS_ARTIFACT_DIR}/gcloud-auth-list.json" 2> "${READINESS_ARTIFACT_DIR}/gcloud-auth-list.stderr"
+          echo "$?" > "${READINESS_ARTIFACT_DIR}/gcloud-auth-list.exitcode"
+          gcloud config list --format=json > "${READINESS_ARTIFACT_DIR}/gcloud-config-list.json" 2> "${READINESS_ARTIFACT_DIR}/gcloud-config-list.stderr"
+          echo "$?" > "${READINESS_ARTIFACT_DIR}/gcloud-config-list.exitcode"
 
       - name: Run readiness checker
         shell: bash
         run: |
           set +e
+          mkdir -p "${READINESS_ARTIFACT_DIR}"
           python3 ops/check_gcp_infra_readiness.py \
-            > .gcp-readiness/gcp-infra-readiness.json \
-            2> .gcp-readiness/gcp-infra-readiness.stderr
-          echo "$?" > .gcp-readiness/gcp-infra-readiness.exitcode
+            > "${READINESS_ARTIFACT_DIR}/gcp-infra-readiness.json" \
+            2> "${READINESS_ARTIFACT_DIR}/gcp-infra-readiness.stderr"
+          echo "$?" > "${READINESS_ARTIFACT_DIR}/gcp-infra-readiness.exitcode"
           python3 - <<'PY'
+          import os
           import json
           from pathlib import Path
 
-          base = Path(".gcp-readiness")
+          base = Path(os.environ["READINESS_ARTIFACT_DIR"])
           report = {
               "artifact": "github_wif_gcp_readiness_probe",
               "checker_exitcode": (base / "gcp-infra-readiness.exitcode").read_text().strip(),
@@ -94,5 +97,5 @@ jobs:
         uses: actions/upload-artifact@v4
         with:
           name: gcp-readiness
-          path: .gcp-readiness/
+          path: ${{ env.READINESS_ARTIFACT_DIR }}/
           if-no-files-found: error
diff --git a/ops/check_gcp_infra_readiness.py b/ops/check_gcp_infra_readiness.py
index 5ec2be6..5c6df1f 100755
--- a/ops/check_gcp_infra_readiness.py
+++ b/ops/check_gcp_infra_readiness.py
@@ -270,6 +270,7 @@ def check_github_actions_readiness_ci() -> Check:
         "google-github-actions/auth@v2",
         "ops/check_gcp_infra_readiness.py",
         GITHUB_ARTIFACT_SERVICE_ACCOUNT,
+        "READINESS_ARTIFACT_DIR: gcp-readiness-artifacts",
         "gcp-readiness-summary.json",
         "actions/upload-artifact@v4",
     ]
@@ -285,7 +286,7 @@ def check_github_actions_readiness_ci() -> Check:
     return Check(
         "github_actions_readiness_ci",
         "pass",
-        "workflow=.github/workflows/gcp-readiness.yml captures readiness stdout/stderr/exitcode through GitHub WIF",
+        "workflow=.github/workflows/gcp-readiness.yml captures readiness stdout/stderr/exitcode through GitHub WIF in a non-hidden artifact directory",
         required_tier="T3_live_readonly",
         current_tier="T2_runtime",
     )
diff --git a/tests/test_gcp_readiness_workflow.py b/tests/test_gcp_readiness_workflow.py
new file mode 100644
index 0000000..68112cd
--- /dev/null
+++ b/tests/test_gcp_readiness_workflow.py
@@ -0,0 +1,10 @@
+from pathlib import Path
+
+
+def test_gcp_readiness_workflow_uses_uploadable_artifact_dir() -> None:
+    workflow = Path(".github/workflows/gcp-readiness.yml").read_text()
+
+    assert "READINESS_ARTIFACT_DIR: gcp-readiness-artifacts" in workflow
+    assert 'mkdir -p "${READINESS_ARTIFACT_DIR}"' in workflow
+    assert "path: ${{ env.READINESS_ARTIFACT_DIR }}/" in workflow
+    assert "path: .gcp-readiness/" not in workflow